A good method of two factor authentication is the use of a smart card. If we allow users to be there own certificate authorities, users could generate there own keys and replace/update their cards when the cards are lost or stolen.
Edit: OpenSC can be used with cards and USB.